Trust

Security

Hosting, isolation, key handling, data retention and disclosure.

Updated 2026-10-25 · MainAI Compute docs

MainAI Compute is operated by MainAI on hardware in the EU. Inference stays on infrastructure we control; there is no US control plane in the request path. The customer contract is the /v1 API; model hosts stay on a private network.

Trust boundariesLink to this section

Boundary	Control
Internet → EU ingress	TLS, CSP, origin checks, body caps, IP limits.
Ingress → API	Bearer key, KYC and contract gate, model allow-list, header sanitation.
API → model network	Private path; upstream credentials never leave the server.
Stripe → portal	Raw-body signature check, event-ID idempotency, amount reconciliation.
Operator → admin	Staff flag, TOTP, append-only audit.

Internet → EU ingress

Control: TLS, CSP, origin checks, body caps, IP limits.

Ingress → API

Control: Bearer key, KYC and contract gate, model allow-list, header sanitation.

API → model network

Control: Private path; upstream credentials never leave the server.

Stripe → portal

Control: Raw-body signature check, event-ID idempotency, amount reconciliation.

Operator → admin

Control: Staff flag, TOTP, append-only audit.

API keysLink to this section

32-byte CSPRNG value with an sk-mai_ prefix.
Shown once; the portal stores a hash plus prefix and last four characters.
Per-key model allow-list, RPM/TPM limits, budget and optional expiry.
Revocation is synchronous and audited.
Keys are never logged in full by the API.

A leaked key is limited by its scope and budget. Revoke it, check Usage for the exposure window, and rotate dependent secrets.

Sessions and passwordsLink to this section

Argon2id, 19 MiB memory, two iterations, one lane; 12-character minimum.
Session token is hashed at rest; cookie is HttpOnly, Secure, SameSite=Lax.
Production cookie uses the __Host- prefix.
Thirty-day absolute session; password reset revokes every session.
Login throttled to five failures per 15 minutes per IP and email pair.
Admin requires TOTP enrolment.

Tenant isolationLink to this section

The organization comes from session membership, never from a request body. Every portal query is scoped to it, and organization switching re-checks membership. The schema is ready for Postgres row-level security.

Data handlingLink to this section

Data	Stored?	Retention
Prompt and completion bodies	No, by default	Transit only
Token counts and model metadata	Yes	24 months
Audit events	Yes	24 months
Cache samples	Counts only	12 months
KYB evidence	Yes	5 years after offboarding
Invoice records	Yes	7 years
Sessions	Hash only	Expiry plus 30 days

Prompt and completion bodies

Stored?: No, by default
Retention: Transit only

Token counts and model metadata

Stored?: Yes
Retention: 24 months

Audit events

Stored?: Yes
Retention: 24 months

Cache samples

Stored?: Counts only
Retention: 12 months

KYB evidence

Stored?: Yes
Retention: 5 years after offboarding

Invoice records

Stored?: Yes
Retention: 7 years

Sessions

Stored?: Hash only
Retention: Expiry plus 30 days

Prompt text can still appear in engine memory and, if gateway exact caching is enabled later, in a Redis response entry. MainAI does not train on customer content.

Transport and headersLink to this section

TLS at the EU ingress; HSTS with a two-year max age in production.
CSP restricts scripts, frames and connections to self plus Stripe.
nosniff, strict referrer policy, frame denial and a minimal permissions policy.
Server, X-Powered-By and all x-mainai-* headers are stripped from public responses.
Admin and internal routing UIs are not publicly bound.

Money and auditLink to this section

The ledger is append-only. Wallet mutations lock the row and share a transaction with the ledger insert. Payment paths require idempotency keys. Every mutation writes an audit row with actor, organization, action, target and IP. Admin adjustments require a reason.

Backups and recoveryLink to this section

Nightly encrypted pg_dump of the service databases, 30-day retention, monthly restore drill. Backups stay on EU storage. The restore path is rehearsed, not improvised during an incident.

Supply chainLink to this section

Dependencies are locked, container images are digest-pinned, and the gateway image is scanned with Trivy in CI. The gateway fork keeps upstream provenance and a small, reviewable patch series. Secrets are scanned before commit.

SubprocessorsLink to this section

Processor	Purpose	Data
Stripe	Checkout, subscriptions, invoices	Billing identity, card via Stripe, VAT data
SMTP relay	Verification and billing mail	Email address, mail body
MainAI (hosting)	Inference and portal	All service data on EU hardware

Stripe

Purpose: Checkout, subscriptions, invoices
Data: Billing identity, card via Stripe, VAT data

SMTP relay

Purpose: Verification and billing mail
Data: Email address, mail body

MainAI (hosting)

Purpose: Inference and portal
Data: All service data on EU hardware

No external KYC vendor is active in the MVP. KYB is manual and evidence stays in the portal database.

No SOC 2 / ISO 27001 report.
No WebAuthn or SSO yet; OIDC/SAML and SCIM are on the roadmap.
No WAF or bot challenge until public launch.
No RLS yet.
No self-serve IP allow-list.
Provider cache metrics disabled; cached-token billing is live.
Manual KYB without sanctions screening.